CVE Vulnerability Catalog

XSS vulnerability in Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26 September 2019) allows injection of malicious script via the JSON parameter 'participant -> name' in the Printable Chat History feature.

Syncovery 9 for Linux version 9.47x and below contains a cross-site scripting (XSS) vulnerability. This flaw could allow an attacker to inject malicious scripts into the user interface.

Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into the web page.

A Security Feature Bypass Vulnerability in the Network Device Enrollment Service (NDES). The description does not include technical details of the vulnerability mechanism.

An issue in MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files from the system, regardless of file type or size.

Leptonica linked library version 1.79.0 contains a flaw that allows attackers to trigger an arithmetic exception via a crafted JPEG file. This results in a Denial of Service (DoS) of the application using the library.

A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files on the system.

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.

A NULL pointer dereference vulnerability exists in the vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in the GPU component of the Linux kernel, reachable via the device file '/dev/dri/renderD128 (or Dxxx)'. It allows a local attacker with a user account on the system to gain privilege and cause a denial of service (DoS).

An out-of-bounds (OOB) memory access vulnerability was found in the vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in the GPU component of the Linux kernel, reachable via the device file '/dev/dri/renderD128 (or Dxxx)'. It allows a local attacker with a user account to gain privilege and cause a denial of service (DoS).

An out-of-bounds memory read flaw in the Linux kernel's BPF subsystem occurs when a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This allows a local user to gain unauthorized access to data.

In the Linux kernel through 5.19.8, drivers/firmware/efi/capsule-loader.c contains a race condition resulting in a use-after-free.

A NULL pointer dereference exists in Vim versions prior to 9.0.0404. It can be triggered by crafted input, causing the application to crash.

A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.

CVE-2022-36083 affects JWE key management algorithms based on PBKDF2, which can be exploited to perform brute-force attacks by manipulating the `p2c` parameter. If misconfigured, an attacker can force disproportionate CPU resource consumption during JWE decryption.

An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.

In include/asm-generic/tlb.h in the Linux kernel before 5.19, a race condition (unmap_mapping_range versus munmap) can allow a device driver to free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.

An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. A misbehaving VMM can write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops and denial of service.